@odla-ai/cli 0.14.0 → 0.14.1

package/dist/bin.js

@@ -2,7 +2,7 @@
 import {
   exitCodeFor,
   runCli
-} from "./chunk-3AC74CD2.js";
+} from "./chunk-AN6KZMR5.js";
 
 // src/bin.ts
 runCli().catch((err) => {

package/dist/{chunk-3AC74CD2.js → chunk-AN6KZMR5.js}

@@ -1669,7 +1669,7 @@ function hostedSecurityCredential(value) {
 // src/security-hosted-github.ts
 async function connectGitHubSecuritySource(options) {
   const out = options.stdout ?? console;
-  const repository = githubRepositoryName(options.repository);
+  const repository = options.repository === void 0 ? void 0 : githubRepositoryName(options.repository);
   const attempt = await requestHostedSecurityJson(
     options,
     "/registry/github/connect",
@@ -1678,7 +1678,7 @@ async function connectGitHubSecuritySource(options) {
       body: JSON.stringify({
         appId: hostedIdentifier(options.appId, "appId"),
         env: hostedIdentifier(options.env, "env"),
-        repository
+        ...repository === void 0 ? {} : { repository }
       })
     },
     "start GitHub connection"
@@ -5079,7 +5079,7 @@ function assertWranglerConfig(cfg) {
 }
 
 // src/provision.ts
-import { createAppsClient, tenantIdFor as tenantIdFor2 } from "@odla-ai/apps";
+import { createAppsClient, tenantIdFor as tenantIdFor3 } from "@odla-ai/apps";
 import { putSecret } from "@odla-ai/ai";
 import process8 from "process";
 
@@ -5232,6 +5232,7 @@ async function safeText3(res) {
 
 // src/provision-helpers.ts
 import { DEFAULT_SECRET_NAMES } from "@odla-ai/ai";
+import { tenantIdFor as tenantIdFor2 } from "@odla-ai/apps";
 function serviceRank(service) {
   if (service === "db") return 0;
   if (service === "calendar") return 2;
@@ -5241,6 +5242,54 @@ function defaultSecretName(provider) {
   const names = DEFAULT_SECRET_NAMES;
   return names[provider] ?? `${provider}_api_key`;
 }
+async function assertTenantAdminAccess(doFetch, cfg, env, token) {
+  const tenantId = tenantIdFor2(cfg.app.id, env);
+  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/entitlements`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (res.ok || res.status === 404) return;
+  if (res.status === 403) {
+    throw new Error(
+      `${env}: you are not an owner of "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; ask an existing owner to run "odla-ai app owners add <your-email>", then re-run provision`
+    );
+  }
+  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
+}
+async function readRegistryApp(cfg, token, doFetch) {
+  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) return null;
+  const json2 = await res.json();
+  return json2.app ?? null;
+}
+async function postJson2(doFetch, url, bearer, body) {
+  const res = await doFetch(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText4(res)}`);
+}
+function normalizeClerkConfig(value) {
+  if (!value) return null;
+  if (typeof value === "string") {
+    const publishableKey2 = envValue(value);
+    return publishableKey2 ? { publishableKey: publishableKey2 } : null;
+  }
+  if (typeof value !== "object") return null;
+  const cfg = value;
+  const publishableKey = envValue(cfg.publishableKey);
+  return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
+}
+async function safeText4(res) {
+  try {
+    return redactSecrets((await res.text()).slice(0, 500));
+  } catch {
+    return "";
+  }
+}
 
 // src/provision.ts
 async function provision(options) {
@@ -5320,6 +5369,9 @@ async function provision(options) {
     await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
     out.log(`app: created ${cfg.app.id}`);
   }
+  for (const env of cfg.envs) {
+    await assertTenantAdminAccess(doFetch, cfg, env, token);
+  }
   const serviceOrder = [...cfg.services].sort((a, b) => serviceRank(a) - serviceRank(b));
   for (const env of cfg.envs) {
     for (const service of serviceOrder) {
@@ -5353,7 +5405,7 @@ async function provision(options) {
     }
   }
   for (const env of cfg.envs) {
-    const tenantId = tenantIdFor2(cfg.app.id, env);
+    const tenantId = tenantIdFor3(cfg.app.id, env);
     credentials = await provisionEnvCredentials({
       cfg,
       env,
@@ -5436,45 +5488,10 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
     }
   }
 }
-async function readRegistryApp(cfg, token, doFetch) {
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
-    headers: { authorization: `Bearer ${token}` }
-  });
-  if (res.status === 404) return null;
-  if (!res.ok) return null;
-  const json2 = await res.json();
-  return json2.app ?? null;
-}
-async function postJson2(doFetch, url, bearer, body) {
-  const res = await doFetch(url, {
-    method: "POST",
-    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText4(res)}`);
-}
-function normalizeClerkConfig(value) {
-  if (!value) return null;
-  if (typeof value === "string") {
-    const publishableKey2 = envValue(value);
-    return publishableKey2 ? { publishableKey: publishableKey2 } : null;
-  }
-  if (typeof value !== "object") return null;
-  const cfg = value;
-  const publishableKey = envValue(cfg.publishableKey);
-  return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
-}
-async function safeText4(res) {
-  try {
-    return redactSecrets((await res.text()).slice(0, 500));
-  } catch {
-    return "";
-  }
-}
 
 // src/secrets-set.ts
 import { putSecret as putSecret2 } from "@odla-ai/ai";
-import { tenantIdFor as tenantIdFor3 } from "@odla-ai/apps";
+import { tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
 var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsSet(options) {
   const name = (options.name ?? "").trim();
@@ -5526,7 +5543,7 @@ async function resolveVaultWrite(options) {
     throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
   }
   const value = await secretInputValue(options, "secret");
-  return { cfg, tenantId: tenantIdFor3(cfg.app.id, options.env), value, doFetch, out };
+  return { cfg, tenantId: tenantIdFor4(cfg.app.id, options.env), value, doFetch, out };
 }
 
 // src/security.ts
@@ -6966,16 +6983,16 @@ async function githubSecurityCommand(parsed, dependencies) {
   }
   assertArgs(parsed, ["config", "env", "platform", "repo", "email", "open"], 3);
   const context = await hostedSecurityContext(parsed, dependencies);
-  const repository = stringOpt(parsed.options.repo) ?? await inferGitHubRepository(process.cwd(), dependencies.readGitOrigin);
+  const repository = stringOpt(parsed.options.repo) ?? await inferGitHubRepository(process.cwd(), dependencies.readGitOrigin).catch(() => void 0);
   const connection = await connectGitHubSecuritySource({
     ...context,
-    repository,
+    ...repository === void 0 ? {} : { repository },
     open: parsed.options.open !== false,
     openInstallUrl: dependencies.openUrl ?? openUrl,
     wait: dependencies.pollWait,
     stdout: context.stdout
   });
-  context.stdout.log(`github: connected ${connection.repository ?? repository} (${connection.sourceId ?? "source pending"})`);
+  context.stdout.log(`github: connected ${connection.repository ?? repository ?? "app repository"} (${connection.sourceId ?? "source pending"})`);
   context.stdout.log("github: odla.ai stores the installation; no PAT or GitHub token is written locally");
 }
 async function listSecuritySources(parsed, dependencies) {
@@ -7269,4 +7286,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-3AC74CD2.js.map
+//# sourceMappingURL=chunk-AN6KZMR5.js.map